Earlier quoted context omitted.
Though there is one part I didn’t understand in that interview. They were complaining of being overwhelmed by AI submitted bug reports (fair), including for obscure codecs that must have been used by a couple of users at most. And therefore implying that securing those codecs is low priority/important. I don’t understand that. To me the severity has nothing to do with how popular is a code path, but whether that code…
That sounds nice in theory, but it seems obvious to me there is a major discrepancy between who is burdened with this responsibility, and who benefits from the result. Given many of these contributors are unpaid volunteers, maybe the infrastructure provider needs to secure FFmpeg in another way, for example by restricting codecs or by running it in a container?
I understand that from the perspective of "how many people will this crash for", but from a security perspective it is nonsensical. Even if it is an uncommon codec if the authors decide to keep the codepath there by default it is exploitable in most installs.
I love ffmpeg but that whole episode left a bit of a bad taste.